KR100998418B1 - Methods for operating virtual networks, data network system, computer program and computer program product - Google Patents

Abstract

The invention relates to a method for operating virtual networks. The method comprises providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag (T1) and a second virtual network comprising a second set of network ports assigned to a second virtualization tag (T2), the first and the second virtual network having compatible address ranges and being adapted to only pass data packets within them, providing a first network node having a source address (SA) in the first virtual network and being operationally connected to a first port (P1) assigned to the first virtual network by means of the first virtualization tag (T1), monitoring the first network node in order to detect a predetermined condition, and, on detection of the predetermined condition, reassigning the first port (P1) to the second virtual network by means of assigning the second virtualization tag (T2) to the first port (P1), such that no data packet can be passed from the first network node (N1) to a second network node (N2) connected to a second port (P2) assigned to the first virtual network by means of the first virtualization tag (T1) directly and keeping of the source address (SA) for the first network node (N1) in the second virtual network (104). The invention further relates to a further method for operation virtual networks, a data network system and a computer program product adapted to perform the inventive methods.

Description

METHODS FOR OPERATING VIRTUAL NETWORKS, DATA NETWORK SYSTEM, COMPUTER PROGRAM AND COMPUTER PROGRAM PRODUCT}

A virtual network having a first virtual network comprising a first set of network ports assigned to a first virtualization tag and a second virtual network comprising a second set of network ports assigned to a second virtualization tag, The first and second virtual networks relate to a method of operating a virtual network having a compatible address range and only transmitting data packets therein. The invention also relates to a data network system, a computer program and a computer program product adapted to carry out the method of the invention.

A virtual network is a logical segment of a physical network, in particular a local area network (LAN). For example, a virtual local area network (VLAN) is described in the IEEE 802.lq standard, which extends the conventional Ethernet standard IEEE 802.1, in particular by an additional packet header containing a VLAN identification tag. Switches and other active network components that are only compatible with the IEEE 802.lq standard only transmit data packets through a network port configured for a VLAN with a VLAN tag corresponding to that contained in the packet header.

The virtual network can be used to create a secure closed network within an insecure open network such as the Internet, for example. In addition, virtual networks can be used to reduce the number of network collisions between data packets, thereby improving network performance.

However, in order to achieve these and similarly objective purposes, network nodes, for example computers connected to a network, and network equipment, for example switches, must be properly configured. For example, a computer needs a valid and unique address within a virtual network. In addition, the computer should be configured with the effective address of an important service node, for example a mail or web server. Switches, routers, and other network facilities, in particular, need to be configured with proper virtual network port assignments. This configuration process is verbose and error prone.

As a result, only a few virtual networks are actually configured by the network administrator. Also, network nodes are rarely moved from one virtual network to another. This is in contrast to some of the objectives that can be achieved, for example, by disconnecting a malfunctioning network node or adjusting a virtual network by a virtual network that alters network performance.

Thus, there is a need for an improved method of operating a virtual network and a data network system.

Summary of the Invention

According to one aspect of the invention, a method of operating a virtual network is provided. The method includes providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag and a second virtual network comprising a second set of network ports assigned to a second virtualization tag, The first and second virtual networks have compatible address ranges and include only transmitting data packets therein. The method also includes a first network node having a source address (SA) in the first virtual network and operably connected to a first port assigned to the first virtual network by the first virtualization tag. Providing, monitoring the first network node to detect a predetermined state, and upon detection of the predetermined state, from the first network node to the first virtual network by the first virtualization tag. No second data packet can be sent directly to the second network node connected to the assigned second port, and the second virtualization on the first port to maintain the source address for the first network node in the second virtual network. Reallocating the first port to the second virtual network by assigning a tag.

By assigning a second virtualization tag to a given first port, the first network node can be moved from the first virtual network to the second virtual network. Since the first and second virtual networks have compatible address ranges and the network address of the first network node remains the same in the second virtual network, moving the first network node from the first virtual network to the second virtual network Transparent to the first network node. Therefore, the configuration of the first network node does not need to be changed. Thus, for example, a network node may be moved from one virtual network to another to separate the first network node from the first virtual network.

According to a useful embodiment of the first aspect of the invention, a predetermined state is given by a state transition of a state machine from a first state to a second state, each state of each state machine being assigned to a virtualized tag. Associated with the assignment of network ports.

By using a state machine to detect a predetermined state, configurations of multiple virtual networks can be created and associated with the state of the state machine. For example, events such as a network failure or the occurrence of a network administrator-initiated action can be used to trigger a state transition and thus the construction of a new virtual network.

According to a second aspect of the invention, a method of operating a virtual network is provided. The method includes providing a first virtual network comprising a first set of network ports assigned to a first virtualized tag and a second virtual network comprising a second set of second virtualized tag assigned network ports. The first and second virtual networks have compatible address ranges and include only transmitting data packets therein. The invention also provides an address operably connected to a first translator port assigned to the first virtual network by the first virtualization tag and a second translator port assigned to the second virtual network by the second virtualization tag. Providing a translator, transmitting a data packet comprising a packet header having a destination address (DA) by a transmitter node connected to a first translator port of the second virtual network; Marking the data packet with the second virtualization tag, determining whether a destination node having the destination address (DA) of the packet header is included in the second virtual network; And if it is determined that it is not included in the second virtual network, Via the data packet to the first or second translator port assigned respectively to the first or second virtualized tag, thereby transmitting the data to a receiver node included in the first or second virtual network for further processing. Redirecting the packet.

By connecting the first and second virtual networks by address translators with network ports in each virtual network, data packets can be routed from one virtual network to another. Thus, it is possible to redirect data packets from a transmitter node located in the second network to a receiver node located in the first or second virtual network. This allows for a successful response from the converter node to the receiver node, especially if the transmitter node has already moved from the first virtual network to the second virtual network.

According to a preferred embodiment of the second aspect of the invention, the receiver node is included in the first virtualized network, and in the redirecting step, the source address included in the packet header is the address translator in the first virtual network. The modified data packet is sent to the first translator port for transmission to the receiver node.

By changing the source address of the packet header, the associated data packet sent from the first translator port remains valid within the first virtual network even if it originates from a transmitter node in the second virtual network. Such an operation can be accomplished by, for example, a network address translation device.

According to another preferred embodiment of the second aspect of the invention, the receiver node is included in the second virtualized network, has a receiver address, and redirects, wherein a destination address included in the packet header is directed to the receiver address. And the modified data packet is sent to the second translator port for transmission to the receiver node.

By changing the destination address and redirecting the changed data packet within the second virtual network, the request from the transmitter node can be redirected to a new receiver node transparently included in the second virtual network.

According to another preferred embodiment of the second aspect of the invention, the receiver node is a proxy node specific to the application protocol.

By providing a proxy node unique to the application, the requests contained in the data packet sent from the sender node can be redirected to that proxy instead of the original destination address. This allows, for example, to handle data packets sent from separate transmitter nodes in the second virtual network differently than data packets originating within the first virtual network.

According to a third aspect of the invention, there is provided a switch comprising: a switch comprising a plurality of ports, each port being assigned to a virtual network by a corresponding virtualization tag, and a switch assigned to the first virtual network by the first virtualization tag. An address translator operatively connected to a second translator port of a switch assigned to the second virtual network by a first translator port and the second virtualized tag, and having a source address (SA) and by the first virtualized tag A data network system is provided, comprising a first network node operably connected to a first port assigned to the first virtual network, the method performing a method according to the first aspect of the invention.

By providing the data processing system with an address translator operably connected to the first and second virtual networks, the first network node can be moved from the first virtual network to the second virtual network without having to reconfigure the first network node. have.

According to a preferred embodiment of the third aspect of the invention, the data network system further comprises a second network node operably connected to the first virtual network or a third network node operably connected to the second virtual network. It is also adapted to carry out the method according to the second aspect of the invention.

By providing a second or third network node in the first and second virtual networks, data packets sent from the first network node to the second network node in the first virtual network or the third network node in the second virtual network are redirected. Can be lected.

According to a fourth aspect of the invention, there is provided a computer program comprising program instructions for performing all the steps of the method according to the first or second aspect of the invention.

According to a fifth aspect of the invention, a computer program comprising a computer readable medium embodying program instructions executable by at least one processor for performing all steps of the method according to the first or second aspect of the invention. Product is provided.

Brief description of the drawings

The invention and its embodiments will be more fully understood with reference to the following description of exemplary embodiments only as preferred embodiments according to the invention taken in conjunction with the accompanying drawings.

FIG. 1A is a schematic network setup including first and second virtual networks, illustrating that a first network node is included in a first virtual network, and FIG.

FIG. 1B is a schematic network setup including first and second virtual networks, illustrating that a first network node is included in a second virtual network, and FIG.

2 shows a schematic internal setup of an address translator,

3 is a schematic state diagram of a finite state machine for determining a virtual network configuration,

4 is a flowchart of an embodiment of a first method of operating a virtual network,

5 is a flowchart of an embodiment of a second method of operating a virtual network.

FIG. 1A shows a schematic network setup that includes a first virtual network 103 and a second virtual network 104. The setup includes a switch 100, a router 109 and an address translator 106. The switch 100 has five ports P1 that can be assigned to the first virtual network 103 by the first virtualization tag T! Or to the second virtual network 104 by the second virtualization tag T2. , P2, P3, P4 and P5). In the given example, the first set 101 of network ports includes ports P1, P2 and P4 that are assigned to the first virtualization tag T1. Network ports P3 and P5 are assigned to the second set 105 of network ports.

Using the network switch 100 as described in the introduction, each data packet received by any network port (P1, P2 or P4) assigned to the first virtual network 103 is converted to a first virtualization tag ( While marked with T1), data packets received from network ports P3 and P5 will be marked with a second virtualization tag T2. Conversely, data packets marked with FIG. 1 or a second virtualization tag T1 or T2 will not be forwarded through the network port associated with the non-matching virtualization tag.

The network setup includes three network nodes N1, N2 and N3 connected to network ports P1, P2 and P3 and having a source address SA, a destination address DA and a receiver address RA, respectively. . In the given example, network nodes N1, N2 and N3 are computers connected to switch 100. In general, any type of network device may be connected to the network ports P1, P2, and P3. In addition, the router 109 is connected to an external network 108, for example, the Internet.

For example, since the network nodes N1, N2, and N3 cannot read, set, or otherwise manually operate the network tags T1 or T2 authorized by the network ports P1 to P3 themselves. The data packet cannot be transmitted directly from the network node N3 to the network node N1 or N2.

The address translator 106 is connected to the first virtual network 103 by the router 100 for the first address translator port P4 of the switch 100. The address translator 106 is also connected by a second address translator port P5 to the second virtual network 104. In the given example, address translator 106 is an external network address translating NAT device. In practice, however, the address translator 106 may be an integral part of the switch 100, in which case the first and second translator ports P4 and P5 may be logical ports, not physical connections. With respect to this application, it will be fully understood that the address translator can send and receive data packets in both virtual networks 103 and 104.

According to the example presented, a predetermined state is detected for network node N1. Such a condition may include, for example, a virus or worm infection of network node N1, another partial or complete malfunction of network node N1, an intrusion prevention system (IPS). Or any other state, such as a request for an abnormal address or high or low network traffic, which may be answered by reconfiguring the network setup. Of course, it is also possible to manually trigger this condition, for example for the needs of the network administrator.

The monitoring of the predetermined state is carried out by the node N1 itself, for example by a virus detection program or a performance monitor, among the network facilities, for example the switch 100, the router 109 or the address translator 106. It may be performed by one or more, or by an external device such as a firewall or network performance monitor not shown in FIG.

FIG. 1B shows a similar schematic network setup that includes first and second virtual networks 103 and 104, respectively. Compared to the configuration shown in FIG. 1A, the setup shown in FIG. 1B is a network port P1 to which the network node N1 is connected such that the network node N1 belongs to the second virtual network 104. ) Is assigned to the second virtualization tag T2.

By logically moving the network node N1 from the first virtual network 103 to the second virtual network 104, a threat detected by monitoring a predetermined condition can be prevented. In this example, the first virtual network 103 is considered a created state virtual network with full access to another network node N2 or external network 108, while the second virtual network 104 is a different network resource. It is considered a separate network with limited access to the network.

For example, if virus infection is detected on network node N1, the network node can be quickly moved to the second virtual network, so that the second network node N2 connected to the first virtual network 103. Prevents infection. Similarly, network node N1 may be separated from external network 108 to prevent transmission of potentially classified information from network node N1 to external network 108.

2 shows an internal setup of the address translator 106. The address translator 106 includes an external address 107 for use with the first translator port P4 assigned to the first virtual network 103. All other internal components of the address translator 106 are assigned to addresses of the second virtual network 104 by the second virtualization tag T2, which is connected to the ports of the second set 105 of network ports. This means that it is accessible to network nodes.

In the given example, the address translator includes an internal proxy 204 assigned to different application level protocols such as HTTP, SMTP, POP3, and IMAP. The proxy 204 may optionally respond or send an application request to a unique protocol. Address translator 106 also includes a patch server 205, a disinfection server 206, and a reconnect initiator 207.

The patch server 205, the disinfection server 206, and the reconnect initiator 207 may be used to provide a service to the second virtual network 104 unique to the network nodes contained therein. For example, if the second virtual network 104 is used to isolate the first network node N1 infected by a virus or other harmful program, the disinfection server 206 may be used to remove the virus. Before the reconnect initiator 207 is used to move the disinfected network node N1 back to the first virtual network 103, the patch server 205 may be configured to prevent future infections. It can be used to install security updates for software running on network node N1.

The address translator 106 further includes an address mapping module 208, which uses the second virtual address using the external address 107 of the address translator 106 in the first virtual network 103. An address of a network node of network 104 may be associated with a data packet sent to first virtual network 103. For example, a so-called network address translation device (NAT) may be used to connect the first virtual network 103 with the second virtual network 104. Typically, a network address translation device is used to connect a private network 104 with an external network 108 such as the Internet using only one externally visible address 107.

The address translator 106 further includes a filtering module 202 and an authentication module 203. The filtering module 202 may be used to redirect address mapping performed by the address mapping module 208 to a predefined set of applications or addresses. Filtering may be done in accordance with the authentication of a particular request, for example, by verifying the username and password provided to authentication module 203 prior to the request.

Although the address translator 106 includes a number of internal proxies 204, servers 205, 206, and 207, and other modules 202, 203, and 208, the address translator 106 may include a switch 100, a router. 109 or part of a combination thereof. As such, the internal components 202 or 208 of the address translator 106 may be implemented as separate units of hardware or software.

3 shows a schematic state diagram of a finite state machine 301 that determines the state of a single network port P1. First, the network port P1 is in a creation state 302 associated with the first virtual network 103. In this case, the node N1 connected to the network port P1 has full access to the first virtual network 103 or another node N2 in the external network 108.

Once a worm or virus infection is detected, network port P1 is switched to notification state 303 associated with second virtual network 104 by state transition 305. In this state, the user or network administrator of the network node N1 may be notified of the infection.

The user or administrator then creates a state by state transition 307, for example, after passive verification that network node N1 does not expose the first virtual network 103 and the threat to successful authentication. Reconnection may be requested for the first virtual network 103 associated with 302.

Alternatively, the user or administrator may require that another state transition 306 be communicated to the fixed state 304 associated with the third virtual network. In certain states 304, network node N1 may be granted access to the service used to remove virus infection, for example for disfection server 206 or patch server 205. After installing the patch and verifying that virus infection has been removed from the network node N1, the first virtualized tag is again assigned to port P1 to create the first node by state transition 308 with the state 302 of creation. Return to associated first virtual network 103.

By using a state machine 301 that monitors a predetermined state and assigns a virtualization tag T1 or T2 to ports P1 through P5 of the switch 100, multiple virtual networks 103 and 104 are easily created. Can be monitored, configured and configured. Accordingly, the network node N1 automatically moves from one virtual network 103 to another virtual network 104 so that the movement to the network node N1 itself is transparent as long as the address spaces of different virtual networks are compatible. Can be.

The available state transitions are internal to the state machine 301d because they depend on the state, and a predetermined state for check can be defined in a context sensitive manner. For example, the network node N1 already in the virtual network 104 associated with the notification state 303 does not need to be monitored for viruses anymore.

The state machine 301 need not be finite as shown in the simple example of FIG. In particular, autonomous agents in large networks can be used to automatically define new states and thus virtual networks, for example for the automatic separation of logically unrelated network resources that are physically connected to a single network. . Such automatic configuration can be used, for example, for performance optimization or for network security.

Thus, the state and state transitions of state machine 301 can be used to encode the configuration of the entire network.

4 is a flowchart of an embodiment of a first method of operating a virtual network. In a first step 402, the first virtual network 103 comprises a first set 101 of network ports assigned to a first virtualization tag T1, and the second virtual network 104 is a second virtualization. First and second virtual networks 103 and 104 are provided, comprising a second set 105 of network ports assigned to the tag T2, having a compatible address range, and only transmitting packets therein. .

In a second step 402, a first port P1 having a source address SA in the first virtual network 103 and assigned to the first virtual network 103 by the first virtualization tag T1. A first network node N1 is operatively connected. For example, the first virtual network 103 can be used to include all network nodes N1, N2 in normal operating state.

In step 403, the first network node N1 is monitored for a predetermined state. Such a condition may include, for example, detection of a worm or virus, detection of abnormally high or low network traffic from or to the first network node N1, or malfunctioning first network node ( Similar symptoms associated with N1).

If no such condition is detected in step 404, monitoring of the first network node N1 continues in step 403. However, if this condition is detected at step 404, the method continues to step 405.

In step 405, the network port P1 with which the first network node N1 is associated with the switch 100 is assigned to the second virtualization tag T2 associated with the second virtual network 104. Thus, the first network node N1 is moved from the first virtual network 103 to the second virtual network 104. However, the configuration of the first network node N1 remains the same. In particular, the network address SA of the first network node N1 used in the first virtual network 103 is also used in the second virtual network node 104.

If the second virtual network node 104 frequently has a compatible address structure for the first virtual network 103, then the switch of the first network node N1 to the second virtual network 104 switches to the first network node N1. ) Is transparent. In particular, if a similar service associated with the predetermined address DA is available for the second virtual network 104 available for the first virtual network 103, the data packet transmitted from the first network node N1 is included. The service request involved will be answered in the second virtual network 104 as before.

5 is a flowchart of an embodiment of a second method of operating a virtual network. In a first step 501 a first virtual network 103 and a second virtual network 104 are provided. This step is the same as step 401 described above.

In step 502 the first translator port P4 assigned to the first virtual network 103 by the first virtualization tag T1 and the second virtual network 104 by the second virtualization tag T2. An address translator 106 is provided which is operably connected to the second translator port P5.

The address translator 106 may be implemented as a separate hardware unit integrated into another network device, such as the switch 100 or router 109, or may be implemented in software. For example, a computer readable medium for implementing program instructions of a program executable by a process included in the address translator 106 or the switch 100 may be provided. The computer readable medium can be, for example, a CD-ROM, flash memory card, hard disk, or any other suitable computer readable medium.

In step 503, the transmitter node N1 connected to the first translator port P1 of the second virtual network 104 transmits a data packet comprising a packet header having a destination address DA. For example, the data packet may be transmitted from the source address SA of the transmitter node N1 to the destination address DA of the second network node N2, as shown in FIG. 1B.

In step 504 the data packet is marked with a second virtualization tag T2 by the transmitter port P1.

In the example shown in FIG. 1 (b), the second network node N2 is included in the first network node N1, for example the creation state virtual network. However, after virus infection on transmitter node N1 is detected, transmitter node N1 has already been moved to a second virtual network 104, for example a separate network.

In that case, the port P1 to which the network node N1 is connected belongs to the second set 105 of network ports, while the network port P2 connected to the node N2 is the same set 101 or 105. By the destination address DA from the transmitter node N1, as belonging to each of the sets 101 and 105 of the ports and only the first set of network ports 101 which transmitted data packets between the ports contained in Direct transmission of data packets to addressed node N2 is not possible.

In step 505, it is determined whether the destination node N2 having the destination address DA of the packet header is included in the second virtual network 104. This function may be performed by, for example, the address translator 106.

If it is determined in step 506 that the destination address DA is included in the second virtual network 104, no other action is taken. The data packet is then sent to the destination address DA in the second virtual network 104 as usual. However, as shown in FIG. 1B, when it is determined that the destination address DA is not included in the second virtual network 104, in step 507, the address translator 106 drops the data packet. Redirect.

The data packet is transmitted to the first or second converter ports P4 and P5, thereby receiving receiver nodes N2 and N3 respectively included in the first or second virtual network 103 and 104 for further processing. Can be redirected to. Especially. By redirecting the data packet through the first translator port P4 assigned to the first virtualization tag T1, the data packet can be moved from the second virtual network 104 to the first virtual network 103.

Therefore, the data packet transmitted from the transmitter node N1 can be delivered to the receiver node N2 included in the different virtual network. However, if the transmission of the data packet from the transmitter node N1 to the network node N2 having the predetermined destination address DA is considered too dangerous, for example, the transmitter node N1 is caused by a virus. Since it is considered to be infected, the data packet can be redirected to another network node N3 included in the second virtual network 104.

This can be accomplished in a particularly easy manner when all the requests for a unique application server are directed to a fixed destination address (DA). For example, the first virtual network 103 may include a network node N2 that provides a request according to a hyper text transfer protocol (HTTP) or a first predetermined destination address DA.

When the application proxy 204 is included in the second virtual network 104 at the same destination address DA, the HTTP request sent from the node N1 included in the second virtual network 104 is sent to the application proxy ( 204). The application proxy 204 can then determine whether to send the received request to the actual network node N2 included in the first virtual network 103 or to redirect the data packet to a different receiver address RA. .

In general, the receiver address RA may be a receiver node N2 in the first virtual network 103, a receiver node N3 in the second virtual network 104, a receiver node in the external network 108, or an address translator 106. May be associated with an internal receiver. If an address translator is connected to more than two virtual networks, of course, the receiver node may be any virtually indirectly connected to the address translator directly, for example via another address translator 106 or router 109. It can be included in the network.

In a particularly important embodiment, the data packet may be stored, for example, to prevent the spread of virus infection from the transmitter node N1 to any network node outside the second virtual network 104 used as a separate network. 2 is redirected to receiver node N3 included in virtual network 104.

The special receiver node N3, included in the proxy 204 of the address translator 106 or otherwise connected to the second virtual network 204, may return the predetermined result to the transmitter node N1. This predetermined result may include, for example, a warning message informing the user of the transmitter node N1 that the transmitter node N1 may be infected by the virus. Similar warnings may be provided for other application protocols such as SMTP, POP3 or IMAP. Instead such a warning message may be sent to the user or network administrator.

Alternatively, the request from transmitter node N1 may be filtered by filtering module 202. Depending on the authentication of the data packet, another data packet may be sent to a unique network node. For example, if the authentication module 203 verifies that it has the privileges required by the network administrator, the request encoded in the data packet authenticated by the network administrator is sent to the disinfection server 206 or the patch server 205. ) May be sent. Similar data packets originating from the user of transmitter node N1 without such authentication may simply be filtered by filtering unit 202.

In the case of virus infection, a method of operating a virtual network has been described using an example of separating the network node N1, but the state machines 301 automatically organize the network nodes N1 to N3 into multiple virtual networks. Similar methods can be used to do this. Such automatic configuration may be used, for example, for organizing network nodes N1 to N3 according to performance requirements.

It will be apparent to those skilled in the art without departing from the spirit of the invention that this embodiment and other embodiments of the method described above will be apparent. For example, the method can be applied to a multiprotocol lebel switching (MPLS) protocol to achieve similarly beneficial effects in wide area networks (WANs).

The network setup shown in Figures 1 (a) and 1 (b) is likewise merely exemplary and will typically be more complex in practice. For example, multiple switches 100 may be connected by several routers 109, address translators 106 or other network devices. The virtual network 103 or 104 may span several physically separate sites, for example, different LANs in a global company internal network.

Reference list

100: switch

101: first set

103: first virtual network

104: second virtual network

105: second set

106: address translator

107: converter address

108: external network

109 router

202: filtering module

203 authentication module

204: proxy

205: patch server

206: Infection Server

207: Reconnect Initiator

208: address mapping module

301: State Machine

302: creation status

303: notification status

304: fixed state

305 to 308: state transition

401 to 405: method steps

501 to 507 method steps

DA: destination address

SA: Source Address

RA: receiver address

N1 to N3: network nodes

P1 to P3: network port

T1: first virtualization tag

T2: second virtualization tag

Claims (11)

As a method of operating a virtual network, Providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag T1 and a second virtual network comprising a second set of network ports assigned to a second virtualization tag T2 Step, wherein the first and second virtual networks have compatible address ranges and transmit data packets only within those ranges; A first network having a source address (SA) in the first virtual network and operably connected to a first port (P1) assigned to the first virtual network by the first virtualization tag (T1) Providing a node N1, Monitoring the first network node N1 to detect a predetermined condition; Upon detection of the predetermined state, a second network node connected to the second port P2 assigned to the first virtual network from the first network node N1 by the first virtualization tag T1 ( No second data packet can be sent directly to N2) and the second virtualization at the first port P1 to maintain the source address SA for the first network node N1 in the second virtual network. Reallocating the first port P1 to the second virtual network by assigning a tag T2. How virtual networks work. The method of claim 1, The predetermined state is given by the state transition of the state machine from the first state to the second state, each state of each of the network ports P1, P2 to the virtualization tags T1, T2. Associated with the assignment How virtual networks work. As a method of operating a virtual network, Providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag T1 and a second virtual network comprising a second set of network ports assigned to a second virtualization tag T2 Step, wherein the first and second virtual networks have compatible address ranges and transmit data packets only within those ranges; A first translator port P4 assigned to the first virtual network by the first virtualization tag T1 and a second translator port P5 assigned to the second virtual network by the second virtualization tag T2. Providing an address translator operatively connected to Transmitting a data packet including a packet header having a destination address DA by a transmitter node N1 connected to a transmitter port P1 of the second virtual network; Marking the data packet with the second virtualized tag T2 by the transmitter port P1; Determining whether a destination node (N2) having the destination address (DA) of the packet header is included in the second virtual network; If it is determined that the destination node N2 is not included in the second virtual network, the first or second translator port assigned to the first or second virtualized tag T1, T2, through the address translator, is determined. Redirecting the data packet to receiver nodes N2 and N3 included in the first or second virtual network by transmitting the data packet to P4 and P5, respectively. How virtual networks work. The method of claim 3, wherein The receiver node N2 is included in the first virtual network, In the redirecting step, a source address SA included in the packet header is changed to a first translator address assigned to the address translator in the first virtual network, and the changed data packet is sent to the receiver node N2. Transmitted to the first converter port P4 for transmission How virtual networks work. The method of claim 3, wherein The receiver node N3 is included in the second virtual network and has a receiver address RA. In the redirecting step, the destination address DA included in the packet header is changed to the receiver address RA, and the changed data packet is transmitted to the second translator port N for transmission to the receiver node N3. Sent to P5) How virtual networks work. The method of claim 3, wherein The receiver nodes N2 and N3 are proxy nodes specific to the application protocol. How virtual networks work. As a data network system, A switch comprising a plurality of ports, each port assigned to a virtual network by corresponding virtualization tags T1 and T2; The first translator port P4 of the switch assigned to the first virtual network by the first virtualization tag T1 and the second translator port of the switch assigned to the second virtual network by the second virtualization tag T2. An address converter operatively connected to (P5), A first network node (N1) having a source address (SA) and operably connected to a first port (P1) assigned to the first virtual network by the first virtualization tag (T1), The data network system, Monitoring the first network node N1 to detect a predetermined condition; Upon detection of the predetermined state, a second network node connected to the second port P2 assigned to the first virtual network from the first network node N1 by the first virtualization tag T1 ( No second data packet can be sent directly to N2) and the second virtualization at the first port P1 to maintain the source address SA for the first network node N1 in the second virtual network. Reallocating the first port P1 to the second virtual network by assigning a tag T2 How to run including Data network system. The method of claim 7, wherein The data network system, A second network node N2 operably connected to the first virtual network or a third network node N3 operably connected to the second virtual network, The data network system, Transmitting a data packet comprising a packet header having a destination address DA by a transmitter node N1 connected to a transmitter port P1 of the second virtual network, Marking the data packet with the second virtualized tag T2 by the transmitter port P1; Determining whether a destination node (N2) having the destination address (DA) of the packet header is included in the second virtual network; If it is determined that the destination node N2 is not included in the second virtual network, the first or second translator port assigned to the first or second virtualized tag T1, T2, through the address translator, is determined. Redirecting the data packet to receiver nodes N2 and N3 included in the first or second virtual network by transmitting the data packet to P4 and P5, respectively. Data network system. A computer readable medium having stored thereon a computer program comprising program instructions for executing a method of operating a virtual network, the computer readable medium comprising: The virtual network, A first virtual network comprising a first set of network ports assigned to the first virtualization tag T1 and a second virtual network comprising a second set of network ports assigned to the second virtualization tag T2; The first and second virtual networks have compatible address ranges and transmit data packets only within that range, have a source address (SA) in the first virtual network and are controlled by the first virtualization tag (T1). A first network node N1 operably connected to a first port P1 assigned to the first virtual network, The method, Monitoring the first network node N1 to detect a predetermined condition; Upon detection of the predetermined state, a second network node connected to the second port P2 assigned to the first virtual network from the first network node N1 by the first virtualization tag T1 ( No second data packet can be sent directly to N2) and the second virtualization at the first port P1 to maintain the source address SA for the first network node N1 in the second virtual network. Reallocating the first port P1 to the second virtual network by assigning a tag T2. Computer readable media. delete A computer readable medium having stored thereon a computer program for implementing a program instruction executable by at least one processor to execute a method of operating a virtual network, the method comprising: The virtual network, A first virtual network comprising a first set of network ports assigned to the first virtualization tag T1 and a second virtual network comprising a second set of network ports assigned to the second virtualization tag T2; The first and second virtual networks have compatible address ranges and transmit data packets only within that range, have a source address (SA) in the first virtual network and are controlled by the first virtualization tag (T1). A first network node (N1) operably connected to a first port (P1) assigned to a first virtual network, and assigned to the first virtual network by the first virtualization tag (T1). An address translator operatively connected to a first translator port P4 and a second translator port P5 assigned to the second virtual network by the second virtualization tag T2; , The method, Transmitting a data packet comprising a packet header having a destination address DA by a transmitter node N1 connected to a transmitter port P1 of the second virtual network, Marking the data packet with the second virtualized tag T2 by the transmitter port P1; Determining whether a destination node (N2) having the destination address (DA) of the packet header is included in the second virtual network; If it is determined that the destination node N2 is not included in the second virtual network, the first or second translator port assigned to the first or second virtualized tag T1, T2, through the address translator, is determined. Redirecting the data packet to receiver nodes N2 and N3 included in the first or second virtual network by transmitting the data packet to P4 and P5, respectively. Computer readable media.

Images